Riskcovery

CVE-2026-93289

OS command injection in Eufy Omni C20, Omni X10 Pro

State
Published
Severity
9.0 Critical
Published
Sep 24, 2026
Updated
Oct 30, 2026
Reserved
Sep 17, 2026

Read the record on cve.org

Description

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process.

Scores

CVSSScoreVectorSource
4.09.0 CriticalCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:Hicscert
3.17.5 HighCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hicscert

Weaknesses

  • CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')

Affected Products

ProductVersions
Omni C20Eufy
  • before 1.4.6Affected
  • 1.4.6Not affected
Omni X10 ProEufy
  • before 3.1.36Affected
  • 3.1.36Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.